Re: Log help

[paul <xml () mailandnews com>]

>  2003-03-12-23:07:34.0153 tcp(6) - 61.172.195.154 80 192.168.0.112 43545: 40 RA

I checked my logs and have reset/ack logs for each of the three
addresses Rhett had within a similar time period. My logs showed
random targets rather than sequential hits. I'd guess it was some
sort of syn flood against a server that doesn't have port 80 open,
or at least was closed it at some point. Since all mine were RST/ACK
and at least one of Rhett's were SYN/ACK, then the web server probably
crashed at some point under the load.

Paul